Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Is There an MITMf ScreenShotter plugin for modern tools like bettercap?

I am looking for a plugin like the ScreenShotter , which is capable of capturing a screen shot of other local network connected devices opened browsers pages using html5 canvas A demo of ScreenShotter ...
user avatar
0 votes
0 answers
37 views

Googleupdate.exe runs ping encoded - Is this expected?

I was looking at our M365 Defender and was doing some looking around. I noticed the process GoogleUpdate.exe run an encoded ping. The command was "GoogleUpdate.exe" /ping <encoded stuff&...
user avatar
  • 133
1 vote
0 answers
24 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
0 votes
1 answer
33 views

Burp suite: URL encoding of request body - Is this safe?

Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is ...
user avatar
0 votes
0 answers
21 views

Encrypted/Encoded text in the Burp HTTPS request - Android [duplicate]

I am analyzing the HTTPS traffic from a particular Android app using the Burp proxy. So every 5 minutes, the app hits an endpoint and sends an encrypted/encoded text in its HTTPS request. I tried ...
user avatar
1 vote
1 answer
37 views

Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?

The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be ...
user avatar
0 votes
1 answer
67 views

How to Find Encryption when knowing Input Plain Text and Output Encrypted Text? [duplicate]

When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint. For example, if I enter the following CR ID : "CR-13261150" it POSTs the ...
user avatar
-2 votes
2 answers
121 views

How to Find Encryption Type by Seeing Encrypted Text? [closed]

When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint. For example, if I enter the following CR ID : "CR-13261150" it POSTs the ...
user avatar
  • 7
0 votes
0 answers
67 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
user avatar
0 votes
1 answer
96 views

How to send a password securely as part of a GET request in rails?

I'm curious to check what could be some possibly secure and recommended ways through which I could send a password as part of a GET request in rails? Just to be explicit, we're using HTTPS in general. ...
user avatar
0 votes
0 answers
39 views

Floss and many tools not detecting cyrillic strings in binary

I am practicing some malware detection basics and it has caught my attention that the Cyrillic alphabet is not detected by practically any traditional string detection tool. Source Code while (...
user avatar
0 votes
1 answer
80 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
user avatar
-1 votes
1 answer
125 views

How do you execute ls -la when encoded as hex? [closed]

There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as ...
user avatar
0 votes
0 answers
14 views

GRZXW5EDY - Does anyone recognize what kind of hash/id is this? [duplicate]

I am black-box testing a video streaming website. They have 2 kind of IDs for videos. internal_id and external_id. I need to find a way to enumerate internal_id but cannot guess what kind of ID this ...
user avatar
0 votes
2 answers
225 views

Percent-encoding in WinSCP in SFTP password, why?

I recently discovered the problem with Percent-encoding. It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
user avatar
0 votes
0 answers
20 views

identify the type of encoding method used here? [duplicate]

). decodes to number 10626 %. decodes to number 9480 *. decodes to number 10887 .. decodes to number 7658 I need help to understand the encoding used here.
user avatar
  • 1
6 votes
1 answer
1k views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
user avatar
  • 28.5k
0 votes
0 answers
126 views

Exploit an XSS without <> and valid encoding

I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following: <script>alert(document.domain)</script> The output in the page ...
user avatar
1 vote
1 answer
121 views

Why don't computers enforce immutable address spaces for execution?

A piece of malware detects signatures of the sandbox an AV solution tries to use to fingerprint malicious behavior and pretends to be innocent. Once in the real OS environment, it then downloads ...
user avatar
  • 765
0 votes
0 answers
87 views

Additional verification, sanitization for transcoded CJK paths in URLs

Suppose there is a file hosting server, and most filenames are strings with mostly CJK characters. Transmitting those characters in HTTP GET requests requires encoding them using UTF-8 (x3 overhead) ...
user avatar
  • 318
11 votes
5 answers
7k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
user avatar
  • 213
1 vote
0 answers
223 views

CyberChef Challenge #21 [closed]

The challenge data is: ...
user avatar
0 votes
1 answer
139 views

script encoder for IDS test

Encoding a payload is a means of evading antivirus or IDS. With regard to scripts is there a way to do the same thing? For instance, is it possible to encode a python script in order test intrusion ...
user avatar
  • 39
0 votes
0 answers
212 views

Error Based SQL Injection

I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
user avatar
  • 11
0 votes
1 answer
394 views

Steganography CTF question

I have recently participated in a CTF competition and failed in the following stage where the solution was never revealed. After a really hard job I got access to a text file that contains a really ...
user avatar
0 votes
0 answers
439 views

Sanitising data for a flutter application

I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
user avatar
  • 101
-1 votes
1 answer
119 views

How a can be decoded as 61 and b as 62...? [closed]

I'm trying to stack overflow of one C program. But I'm confused by encoding or decoding algorithms. I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert ...
user avatar
2 votes
1 answer
652 views

What is LS0... encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. ...
user avatar
2 votes
1 answer
242 views

Does anyone know what this encoding format for passwords is? I think it is a decimal array but I can't seem to convert it

During a penetration test, I ran across a server that was storing passwords in its database in what seems to be a binary array of sorts: password_table 1,12,12,12,122,21,13,00,00,00,000 11,112,443,12,...
user avatar
1 vote
1 answer
161 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
user avatar
0 votes
1 answer
99 views

How to know what type of encryption type is that? [duplicate]

the hash is a lot of numbers separated by hyphens, something like that 02-35-161-51-43-227-161-06-151-43-22-71-43-46-21.... More than 700 numbers.
user avatar
  • 1
1 vote
0 answers
372 views

How to unencode email urls rewritten by Black Spider [closed]

Since a few months, many organisations have urls in incoming mail rewritten to be redirected through a checking service (Outlook Safelinks, Proofoint, FireEye, Black Spider/Forcepoint). Because this ...
user avatar
  • 111
0 votes
0 answers
111 views

How to facilitate secure chats between users

My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
user avatar
  • 63
1 vote
1 answer
756 views

Security Report about "Insecure Content-Type Setting": Does this apply to CSS and JavaScript as well?

I am working through a report of an automated vulnerability scanner. One Item is Web Server Misconfiguration: Insecure Content-Type Setting ( 11359 ) It's about not returning the character-set for ...
user avatar
  • 3,512
4 votes
1 answer
550 views

How does URL Encoding work?

I am learning about web security, but I'm very confused about URL Encoding. On PortSwigger, I learned that the URL http://127.0.0.1/admin can be written as http://127.0.0.1/%2561dmin by encoding a as ...
user avatar
1 vote
1 answer
229 views

What is a LUKS cipher-name "@"?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
user avatar
1 vote
0 answers
907 views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
user avatar
  • 777
11 votes
1 answer
25k views

How to check if an mp4 file contains malware?

I am not that familiar with security and malware analysis, but I know it is theoretically possible to embed a malware into files like video, audio ... Say that someone managed to embed a malware ...
user avatar
  • 213
0 votes
1 answer
108 views

How to determine the type [duplicate]

Today I discover a encryption method Which 0 = 35 1 = 34 2 = 37 3 = 36 4 = 31 5 = 30 6 = 33 7 = 32 8 = 3d 9 = 3c It's the encode of number 1 to 0 for the method Can you please help me to ...
user avatar
0 votes
0 answers
27 views

What type of encoding is this string? [duplicate]

I have an encoded string: VH+_+smN+IPimspbC+_+ygX73g== The original string is: 51756 So 51756 => VH+_+smN+IPimspbC+_+ygX73g== What is the encoding algorithm type? How can decode VH+_+smN+IPimspbC+...
user avatar
  • 101
1 vote
1 answer
147 views

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
user avatar
  • 33
1 vote
1 answer
3k views

Demonstrating reflected XSS with GET Parameter and URL encoding

A client is developing a website which is vulnerable to reflected XSS through a GET parameter: https://example.com/vulnerable-url?")||true)alert("XSS");</script> I would like to demonstrate ...
user avatar
1 vote
1 answer
419 views

Help with decoding this? Base64 attack [closed]

I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something....
user avatar
  • 15
0 votes
1 answer
275 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
user avatar
  • 1
37 votes
2 answers
7k views

What does this "ICAgICAg…" mean in public key certificates and messages?

I noticed that the string ICAgICAgICAgICAgICAg, in various repeating lengths, appears fairly often in public key certificates and ciphertexts. What does this mean? Is it some kind of padding? Is it ...
user avatar
3 votes
1 answer
482 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
user avatar
1 vote
0 answers
21 views

determine type of encoding/encryption [duplicate]

Is there a way to find out what type of encryption is being used on this data? I was playing around with a game data and i cant get around it . This Is the data im trying to decrypt, any help? Code: ...
user avatar
0 votes
0 answers
2k views

How to solve: Problem with converting pkcs12 file into a pem

I am trying to convert a client certificate from a pkcs12 type to a pem file using openssl, but this error is showed on my terminal. Does anyone have any idea why this is happening? I haven't edited ...
user avatar
0 votes
1 answer
192 views

How to fix XSS in rails

I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode ...
user avatar
2 votes
2 answers
3k views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
user avatar
  • 153